CVE-2020-25868: 
Pexip Infinity Management Node vulnerability analysis and mitigation

Pexip Infinity versions 22.x through 24.x before 24.2 contains an Improper Input Validation vulnerability in the call setup functionality. This vulnerability allows an unauthenticated remote attacker to trigger a software abort resulting in temporary loss of service. The vulnerability was disclosed in July 2021 and has been assigned a CVSS v3.1 base score of 7.5 (High) (NVD, Vendor Advisory).

The vulnerability stems from improper input validation in the call setup functionality. When processing call setup requests, the system fails to properly validate input parameters, which can be exploited by sending specially crafted requests. The vulnerability has been assigned CWE-20 (Improper Input Validation) and has a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility, low attack complexity, no privileges required, and high impact on availability (NVD).

The successful exploitation of this vulnerability results in a temporary loss of service through a software abort. Since the vulnerability affects the call setup functionality, it could potentially disrupt communication services for users attempting to establish new connections (NVD).

The vulnerability can be exploited by an unauthenticated remote attacker without requiring user interaction. The low attack complexity and lack of required privileges make this vulnerability relatively straightforward to exploit (NVD).

The vendor has addressed this vulnerability in Pexip Infinity version 24.2. Users are advised to upgrade to this version or later to resolve the issue. No temporary workarounds have been documented (Vendor Advisory).